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We consider the security of the Bennett-Brassard 1984 (BB84) protocol for quantum key dis- 
tribution, with arbitrary individual imperfections simultaneously in the source and detectors. We 
provide the secure key generation rate, and show that three parameters must be bounded to ensure 
security; the basis dependence of the source, a detector blinding parameter, and a detector leakage 
parameter. The system may otherwise be completely uncharacterized and contain large losses. 
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I. INTRODUCTION 

Quantum Key Distribution (QKD) is a method for dis- 
tributing a secure key to two communicating parties, Al- 
ice and Bob. The most common QKD protocol, BB84 
PQ, has been proved secure by a number of approaches, 
some of which include different kinds of imperfections in 
the equipment [2H7] . The ultimate goal of QKD security 
analysis is to take all kinds of imperfections into account, 
at least those that cannot be eliminated completely by 
a suitable design of the setup. So far, most of the avail- 
able security proofs for BB84 consider imperfections at 
the source or detector separately. An exception is the 
work by Gottesman et. al. [5], which treats the security 
in the presence of source flaws and a squashing detector 
with certain, limited imperfections. Also of interest is 
the paper by Hayashi [8], which combines finite length 
key analysis with photon number imperfections at the 
source. Proving security for a realistic system with arbi- 
trary imperfections, simultaneously in the source, chan- 
nel, and detectors, has so far been an open problem. 

A particularly suitable approach for practical QKD is 
to limit the assumptions about the equipment. By con- 
sidering entanglement-based protocols with detectors in 
both ends of the system [SJ, one can prove security in 
a rather general setting [TU], assuming collective attacks 
and individual imperfections [11] . While these protocols 
and security proofs are promising, they do not neces- 
sarily provide security for realistic devices. All realistic 
systems have large losses due to the channel and limited 
detector efficiencies. An eavesdropper Eve may use im- 
perfect detection efficiencies to effectively control Bob's 
basis choice [T21 02] . Using this detection- loophole, she 
may perform the identical measurement as Bob to obtain 
a perfect copy of the key [2rJ] , 

In this work we will prove security for BB84 with any 
combination of individual imperfections as well as chan- 
nel losses. By individual imperfections we mean that 
the operation of the devices for a particular signal is in- 
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dependent of earlier signals. To obtain such generality, 
we describe the actual physics in the protocol, rather 
than using e.g. squashing models with "tagging" . Thus, 
the detectors are described as a basis-dependent quan- 
tum operation on the actual state space, in front of a 
three-outcome measurement ("0", "1", and "vacuum"). 
Describing the detector in this way also enables an ele- 
gant solution to the problem of combining errors in the 
detectors and errors in the source. 

To get around the detection loophole, we anticipate 
that at least two parameters must be known or bounded 
about the system; one for the source and one for the 
detectors. Our proof is formulated with two such param- 
eters; the basis dependence of the source and a detec- 
tor blinding parameter. In addition to these parameters, 
we include a third parameter quantifying leakage from 
Bob's detectors. Once these parameters are bounded, 
the system may contain bit and basis leakage from Al- 
ice, multimode behavior, basis-dependent misalignments, 
losses, nonlinearities, basis-dependent threshold detec- 
tors with detector efficiency mismatch and information 
leakage, dark counts, etc. In that sense, our proof of- 
fers the generality of the entanglement-based scenarios 
|11) . applies to realistic scenarios with loss, and provides 
universal composable security against the most general 
attacks. 



II. PROTOCOL 

Consider the following BB84-like protocol, the actual 
protocol. Alice chooses basis a = Z or a = X randomly 
according to some probability distribution and prepares 
the state \xa), where 

\xz) = V^|0)| / 3 ) + v / l 3 ^|l)IA) I (la) 

Wx) = V^|+)|/3 + ) + V / r 3 ^|-)l/3->- (lb) 

Here pz and px are probabilities, |0), |1) are some or- 
thonormal qubit basis states, and |±) = (|0) ± \l))/y/2. 
Alice measures the qubit in the a-basis (this measure- 
ment can be delayed to the end of the protocol). She 
repeats the procedure to obtain a large number of "/3 
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states", which are sent via Eve to Bob. These j3 states 
include any system that is correlated to Alice's system 
and to which Eve has access. Note that Eve is free to 
send anything to Bob, including parts of (3 and/or any 
state of her own choice. Depending on Alice's source 
the four different /3-states will differ in photon number 
statistics, polarization, wavelength, etc. Any leakage in 
non-photonic side channels will also be included in these 
states. With no loss of generality, the /3-states are as- 
sumed pure; if they were mixed, we could simply purify 
them, sending the auxiliary, purifying system to Eve. 

For each state received by Bob, he chooses a "basis" 
variable b according to some probability distribution and 
conducts measurements Mf,. The measurements Mj, have 
three outcomes, "0", "1", and "vacuum". When he ob- 
tains "0" or "1" he publicly acknowledges receipt. After 
transmission, Alice and Bob broadcast a and b. When 
b = X they openly compare their measurement results 
to estimate the fraction qx of nonvacuum events at Bob 
when a — X, the corresponding error rate Sx, and the 
fraction g p h of nonvacuum events when a = Z . After 
this estimation only the n states for which a = b = Z 
are kept. Discarding all events where Bob detected "vac- 
uum" , Alice and Bob each end up with nqz bits. Alice's 
bits are the raw key. 

We will now summarize Koashi's generic framework 
for security proofs [141 115) . Imagine a virtual experiment 
where Alice measures her final nqz qubits (correspond- 
ing to the raw key) in the X-basis instead of Z-basis. In 
this virtual experiment, instead of measuring Mz, Bob 
now tries to predict the outcome of Alice's measurement. 
To do this, he may do whatever is permitted by quantum 
mechanics, as long as he does not alter the information 
given to Eve. Let H v [ It x(A\B — u) denote the entropy of 
Alice's result, given measurement result a in Bob's pre- 
diction. Let H v i Tt x(A\B = fi) < H for some constant 
H. Since the uncertainty after Bob's prediction is less 
than H, the entropic uncertainty relation |16| suggests 
that anyone (including Eve) cannot predict the outcome 
of a Z-basis measurement by Alice with less entropy than 
nqz — H. This indicates that Alice can extract nqz — H 
bits of secret key. The quantity H is to be found from 
the estimated parameters qx, Sx, and q p h [27]. The de- 
tailed proof [14] of the fact that Alice can extract nqz — H 
bits of secret key is based upon the universal, compos- 
able security definition, and considers the actual privacy 
amplification protocol by universal hashing. 

To ensure that Bob has the identical key, we note that 
it does not matter to Eve what Bob does (as long as he 
gives the same receipt acknowledgment information); he 
can as well measure Mz- Then Bob obtains the identical 
raw key from his measurement result and nqzh(Sz) extra 
bits of error correction information from Alice, consum- 
ing nqzh(8z) of previous established secure key. Here 
h(-) is the binary Shannon entropy function, and the er- 
ror rate Sz can be estimated by sacrificing a subset of 
the raw key (whose size we can neglect in the asymptotic 
limit n —¥ oo). We therefore obtain the asymptotic net 



secure key generation rate 

Rz>l-H/nqz-h(5 z ). (2) 



III. INDIVIDUAL IMPERFECTIONS IN THE 
DETECTORS 

We first consider the situation where Alice's source is 
perfect (\xx) = \xz)) and Bob's detectors can be sub- 
ject to any kind of individual imperfections. With the 
understanding that Bob chooses his bit randomly for co- 
incidence counts [SI |5] , his detectors can be modeled by 
a basis-dependent quantum operation (£z and £x) in 
front of a measurement with three possible outcomes: 
"0", "1", and "vacuum". Note that there is no need to 
require a squash model [5] (TTJ [18] in our proof as Bob's 
basis selector is included into the basis-dependent quan- 
tum operation. 

In addition to the optical modes, there may also be 
other relevant degrees of freedom in the detector. For 
example, dark counts are caused by physical processes 
internally in the detector. Thus we consider an extended 
state space consisting of the Fock space of all optical 
modes in addition to the state space associated with 
"electronic" degrees of freedom inside the detectors. Pes- 
simistically, we let Eve control all degrees of freedom. 

The quantum operations £ z and Ex are decomposed 
as follows: First there is a basis-dependent quantum op- 
eration {Fz and Tx ) acting on the Fock space associated 
with all optical modes. This operation contains Bob's ba- 
sis selector. The operations Tz and Tx are assumed pas- 
sive in the sense that if vacuum is incident to all modes, 
there will also be vacuum at the output. Then there is 
another quantum operation T describing interaction be- 
tween the photonic state and internal degrees of freedom 
in the detectors, see Fig. [I] The quantum operation T 
may be active in the sense that even though vacuum is 
incident to all optical modes, there may be nonvacuum 
detections. When the optical modes contain the vacuum 
state, we can (pessimistically) assume that Eve has full 
control over Bob's detectors through T; in other words, 
she controls the dark counts directly with the "electronic" 
modes. The quantum operation T is assumed to be inde- 
pendent of Bob's basis choice. This assumption is natural 
as Bob's basis choice does not influence internal degrees 
of freedom in the detector. In other words, when Eve 
emits the vacuum in all optical modes, Bob's basis choice 
will not affect the detection statistics. 

To achieve a completely general detector model, we 
should not only let Eve control the detectors; in addition 
we must let information return to Eve. Consider the case 
where Bob has chosen the Z-basis. In the most general 
case the information leakage is quantum, i.e., a part of 
the total Hilbert space is given directly to Eve. Replacing 
this part of the Hilbert space by some standard state 
<T2, we can quantify the leakage tz by the trace distance 
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FIG. 2: Bob's setup for virtual X-basis prediction. The 
optical and electronic modes are denoted by a single line in 
this figure. 



FIG. 1: Bob's detectors consist of a basis-dependent quantum 
operation (Ez — T o Tz and £x = T ° ^x) in front of a 
three-outcome measurement. The fact that Eve gets arrival 
information from Bob is included through a dedicated vacuum 
measurement preceding Bob's three-outcome measurement. 
On the input side of J-, the lower line contains the electronic 
modes of the detector, while on the output side of IF, the 
lower line indicates the part of the Hilbert space leaked to 
Eve. Alice's classical bit, indicated in the upper part of the 
figure, is included in the state a. 

D(-, •) as follows: 

ez = minmaxD((T, <j\ ® a-i). (3) 

<72 p 

Here p is any state at Bob's input (including Alice's part 
of the system, see Fig. |T|), tr is the state of Alice and 
Bob before leakage, and o\ = Tr 2 (cr) is the state of the 
remaining Hilbert space after leakage. Note that these 
density operators refer to a single signal, not the entire 
block of n signals. The parameter ez measures the cor- 
relation between the leaked quantum state and the state 
of Alice and Bob, maximized over states sent by Eve. 
More precisely, ez is the maximum probability that the 
actual state before leakage can be distinguished from the 
state where the leaked part is replaced by the standard 
state 02 [IS]- Eq. ([3]) has another very useful physical 
interpretation: Choose a fixed 02, dependent on £z, but 
independent of the state coming from Eve. For any a, 
the probability of a measurement result of o\ ® 02 devi- 
ates no more than ez from the corresponding probability 
when measuring a 19J. 

Although we now have a general detector model, we 
add one little feature. In the actual protocol, Eve gets 
to know whether a particular signal was detected. This 
can be included as an extra projective measurement with 
projectors P and I — P, where / — P is a projector onto 
the subspace corresponding to detection result "vacuum" 
in Bob's measurement. Clearly this addition does not 
disturb Bob's measurement statistics. The composed 
measurement consisting of Ez followed by this projec- 
tive measurement will be referred to as Eve's vacuum 
measurement. It can be described by some POVM ele- 
ments E and I—E, where I — E corresponds to detection 
result "vacuum" at Bob. Including Eve's vacuum mea- 



surement separately, rather than absorbing it into the 
quantum leakage ([3]), leads to a better rate. The reason 
is that the information from the vacuum measurement 
is classical and available to Bob, as opposed to general, 
leaked quantum information. 

Having described the model, we now turn to the se- 
curity analysis. As before, Alice extracts the key in the 
Z-basis. In Koashi's security proof, Bob wants to predict 
the outcome of a virtual X-basis measurement by Alice. 
In this virtual prediction there is only one important re- 
striction: Bob is not allowed to alter the information 
going to Eve. Thus Eve's vacuum measurement must be 
retained. 

The setup used by Bob to perform the virtual A"-basis 
prediction is depicted in Fig. [2] The state from Eve 
is incident to a first vacuum measurement, Bob's vac- 
uum measurement, a projective measurement with cer- 
tain projectors Q and I — Q, corresponding to results 
"nonvacuum" and "vacuum" , respectively. Then it goes 
through the quantum operation Ez, and leaks partially 
back to Eve. The remaining part is measured by Eve's 
vacuum measurement, and sent through a reversal oper- 
ation. The goal of the reversal operation is to reverse the 
effect of the vacuum measurement, so that the combined 
operation consisting of Eve's vacuum measurement and 
the reversal operation is identity, with a certain prob- 
ability. Finally, the quantum operation Ex and Bob's 
three-outcome measurement are applied. 

To analyze Bob's virtual prediction, we note the fol- 
lowing observations. The quantum operation Ez can be 
viewed as a unitary operation on an extended state space. 
Moreover, since Bob's reversal operation does not have 
to be realizable in practice (only in principle) we may 
assume that Bob has access to any extra degrees of free- 
dom used to "unitarize" Ez- He does not have access to 
the quantum state leaked to Eve; however, the leakage 
disturbs the probabilities of Bob's prediction by no more 
than ez- Therefore, for the moment we can ignore the 
leakage, taking it into account in the final expression for 
the key rate. 

To proceed, we need the following results. 

Lemma 1 (Koashi and Veda 12Qjj ). Let E, acting on 
a Hilbert space %, be a POVM element associated with 
some measurement M. If any state in some sub- 
space Q C H is measured with M , the measured state 
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can be reversed to the original state, with maximum 
joint probability of outcome E and successful reversal 
inf, 

$)£Q,{$\<s>)=i(®\E\®) ■ H is possible to know when the 
reversal is successful or not. 

Lemma 2 The output of a quantum operation £b is mea- 
sured with projectors Pq, Pi, and I— Pq — Pi, correspond- 
ing to detection results "0", "1", and "vacuum", respec- 
tively, or alternatively, with P = P + Pi and I — P. Let 
I — Q be a projector onto an input subspace of £b that 
leads to detection result "vacuum" with certainty. The 
measurement statistics are not changed by the presence 
of a projective measurement {Q, I — Q} before £b- 

Proof: Lemma [2] is not as trivial as it may appear at first 
sight since states in the support of Q may also lead to de- 
tection result "vacuum" . Thus the measurement before 
£b gives extra information. Nevertheless, the quantum 
operation £{, can be viewed as a unitary transformation 
on an extended Hilbert space, with a standard state as 
auxiliary input. Clearly it does not matter if we mea- 
sure the extra degrees of freedom at the output. This 
measurement can be constructed so that the total out- 
put measurement distinguishes between input states in 
the support of Q or I — Q. Then, an input measurement 
{Q, I — Q} is redundant. 

More precisely, the unitary operator can be chosen 
such that the projective measurement at the output is 
implemented as a measurement of a single qutrit in the 
computational basis. Thus it transforms 
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etc. Here |0,) and are bases for the support of I — Q 
and Q, respectively, |0) aux is the auxiliary standard state, 
and |0)(0| = P , |1)(1| = P u and \v){v\ = I-P Q -P X . The 
t[>- and 0-vectors are (not necessarily normalized) states 
of the remaining part of the output state space. Since 
(U\0j) = 0, we have {4>i\ipj) = for any i,j. Thus, by a 
measurement of the tp or <j) part of the output state space 
in addition to the qutrit, we can distinguish between the 
|0i) states and |L) states. □ 

We define the projector / — Q so as to project onto 
vacuum in all photonic modes, and onto the biggest sub- 
space of the "electronic" modes that gives detection re- 
sult "vacuum" in Eve's vacuum measurement. The or- 
thogonal subspace, which is the support of Q, is denoted 
Q. Lemma [2] ensures that Bob's vacuum measurement 
does not change the statistics of Eve's vacuum measure- 
ment. When Eve's vacuum measurement gives result 
"vacuum" , or the reversal operation is not successful, 
the reversal operation is assumed to output a state in 



the support of I — Q. Thus in these cases the output of 
Bob's virtual prediction is "vacuum" with certainty. 

If the outcome of Bob's vacuum measurement is "vac- 
uum" , the outcome of Eve's vacuum measurement is 
"vacuum" , and the reversal operation is successful with 
certainty. Suppose the outcome of Bob's vacuum mea- 
surement is "nonvacuum" . According to Lemma [TJ 
the maximum joint probability of result E in Eve's 
vacuum measurement and successful reversal is r]z = 
inf|$) e g i ($|$)=i(<i>|.E|<I>). When result E and the reversal 
is successful (and Bob knows when it is), the statistics of 
Bob's measurement compared to Alice's virtual X-basis 
measurement will be identical to that of Alice's and Bob's 
ordinary parameter estimation in the X-basis, except for 
any disturbance by Bob's vacuum measurement. Accord- 
ing to Lemma [2] such disturbance does not exist. The 
number of detection events E in Eve's vacuum measure- 
ment is nqz', of these nqxrjz is successfully reversed and 
detected as "0" or "1" in Bob's virtual prediction. Thus 
we obtain H < (nqz — nqx°r\z) + nqxT)zh(Sx), which 
gives us the rate 



Rz > Vzqx/qz(l - h(6 x )) ~ h(S z ). 



(6) 



The parameter rjz = inf| < j,) 6 Q i ($|$) =1 ($|£ , |<I>) is the 
minimum probability that a state in Q gives result E by 
Eve. This parameter has a clear physical interpretation. 
When vacuum is incident to the optical modes, recall 
that with no loss of generality we may assume that Eve 
has full control of the detectors through the "electronic" 
modes. Then there are no losses of her excitation in 
the "electronic" modes through the quantum operation 
J- . Thus, we identify r\z as the minimum probability 
that a nonvacuum photonic state is detected by Bob. In 
other words, 1 — r\z is the maximum probability that a 
nonvacuum photonic state is absorbed in the detectors 
and detected as vacuum in the actual setup (Fig. [lj. 

So far we have ignored the effect of any quantum 
leakage from the detectors. Parameterizing the leak- 
age by pi), tz quantifies the maximum deviation of any 
measurement probabilities. In the absence of leakage, 
the probabilities of correct and incorrect predictions are 
qxVz(l — Sx) and qxVzSx, respectively, while the prob- 
ability of vacuum result is 1 — qxVz- When there is leak- 
age, in the worst case these probabilities are changed to 

qxVz{l- 6x) - ez, qxVzSx +<=z - and 1-qxVz +£,, 
respectively. Here £ is an unknown parameter satisfying 
< £ < ez- Of the nqz nonvacuum results in Eve's 
vacuum measurement, there are n{qxf]z — nonvacuum 
results in Bob's virtual prediction. This leads to 



H < nq z - n(q x riz - £) 



n(qxVz - h 



qxVzSx + ez - £ 

qxvz - £, 



nqz - nq \ >\z + nq.xuzli { <H ■!- 



qx-nz, 



(7) 



The last inequality in (|7| can be found after some algebra 
using the facts that h(u) — h(u — A) > h'(u)A for A > 
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and u < 1/2, and h'(u)(l 
we have set u = Sx J — — 



> 1 for u < 0.277. Here following conditional probabilities. 



This gives the rate 
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1-h 5 



>x 



qxVz 



h(S z 



(8) 



for Sx + q ^ lz < 0.277. An expression for the rate, 
also valid for 0.277 < Sx H — < 0.5, can be derived 

— •* qxVz — ' 

straightforwardly; however, this regime is only relevant 
for very small Sz, and large Sx and/or ez . 



IV. INDIVIDUAL IMPERFECTIONS IN THE 
ENTIRE SYSTEM 



From the previous section we note that when the re- 
versal operation is successful (and Bob knows when it 
is), the measurement statistics in the prediction becomes 
identical to the statistics if Bob measured in the X- 
basis. This makes it possible to consider simultane- 
ous imperfections at the source and detector. We may 
then consider the case where Alice creates a general 
state p a depending on the basis choice a. The basis de- 
pendence of the source is characterized by the fidelity 
F{pz,Px) = ^(^/pzpxy/pz)? ■ We let this dependence 
be bounded by a parameter A defined by F > 1 — 2 A. 
By Uhlmann's theorem there exist purifications, \x a ) of 
p a , such that (xz I Xx) — 1 — 2A. We note that \x a ) can 
be expressed as in Eq. 0. 

Again, we first ignore the detector leakage, taking it 
into account in the final expression for the rate. Since 
Bob wants to predict Alice's virtual X-basis measure- 
ment on \xz), the parameters Sx and qx in ([6} must be 
replaced with S p h and q p h respectively. Here <5 p h is the 
error rate when Alice measures her part of \xz) m the 
X-basis and Bob measures his part using Mx- 

In BB84 such a measurement is not actually per- 
formed, but <5 p h can be bounded from the measured error 
and transmission rates. We expand the statistical argu- 
ment from |14| to include "vacuum" as a possible mea- 
surement result. Assume that for the systems used in the 
random sampling Alice chooses her basis by measuring a 
quantum coin in the Z-basis. Then these systems can be 
described by state |*) = (\xz) |0) + \xx) |l))/\/2, with 
the last system being that of the quantum coin. 

We then consider the situations where Alice and Bob 
both conduct A-basis measurements. For each measure- 
ment a variable t is assigned the value t = if their 
results are the same, t = 1 if there is an error, and t = 2 
if Bob gets no result. Alice then measures her quantum 
coin in the Z-basis, getting the result c. We obtain the 



p(t = 


0|c = 


1) 


= q x (l - S x ) 


p(t = 


0|c = 


0) 


= <7 P h(l - 8ph) 


p(t = 


l|c = 


1) 


= qxSx 


p(t = 


l|c = 


0) 


= q P hS P h 


p(t = 


2|c = 


1) 


= 1 - qx 


p(t = 


2|c = 


0) 


= 1 - <7 P h- 



(9a) 
(9b) 
(9c) 
(9d) 
(9e) 
(9f) 

Assuming that the systems used to estimate error and 
transmission rates are randomly chosen, the probabilities 
given c = are also valid for the systems used to extract 
the raw key. 

Now assume that for some states Alice measure the 
coin in the X-basis getting measurement result c. Note 
that 



Y,p(t = j)p(c=l\t = j) = A. 



(10) 



Using j9||, ([TO} and the bound [H] 

(1 - 2p(c = l\t = j)) 2 + (1 - 2p(c = 0\t = j)) 2 < 1 
we find 

1 - 2A < VKt = j\a = Z)p{t = j\a = X) (11) 

3 

= yQxO- - S x )q P h(l - S ph ) + \/qxSxq P hS P h 



Sph can now be taken to be the maximal value for which 
the inequality is obeyed. 

Similarly to the analysis in the previous section, we 
can include detector leakage by modifying the detection 
probabilities. As in ([8]), the leakage is accounted for by 
adding a term proportional to the leakage parameter ez, 



Sph < Sph + 



ez 



qphvz 

We have arrived at our main result. 
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Theorem 1 In BB84 the basis- dependence of Alice's 
source is bounded by F(px,pz) > 1 — 2A. Bob's detec- 
tors are modeled by a passive, basis- dependent quantum 
operation (Tz and Tx ) acting on the multimode photonic 
state, followed by a basis-independent quantum operation 
(T) describing interaction with internal degrees of free- 
dom in the physical detector, followed by a measurement 
with three outcomes "0", "1", and "vacuum". Suppose 
Eve controls the photonic modes and the internal degrees 
of freedom in the detectors, and that a quantum state 
leaks back to Eve from the detectors. Then the asymp- 
totic secure key generation rate for key extraction in the 
Z-basis satisfies 



Rz > vzq P h/qz 1 - h(6 p h) ~ h(S z ) 



(13) 



G 



provided (5 p h < 0.277. Here 5z is the estimated error rate 
in the Z-basis, 5 p h is given by (111 and (12), l — r)z is the 



0.15 



maximum probability that a non-vacuum photonic state 
is detected as "vacuum" , and q p h/qz is the ratio between 
the detection rates for Bobs measurements Mx and Mz 
given that Alice sends in the Z-basis. 



The rate ( 13 ) is valid for any kinds of individual imper- 
fections and loss. The parameters qx, qz, <7phi &x, an d 
5z are estimated directly in the protocol, while A, rjz, 
and ez characterize the practical setup. 



V. DISCUSSION OF RESULTS 

In this discussion we assume that the quantum channel 
is symmetric with respect to loss i.e. qx = q P h = qz = q- 
This will be approximately true for most setups. We 
also assume no information returned to Eve from the 
detectors, ez — 0, anticipating that such errors could 
be avoided by modifying the setup. 

In this case (11) reduces to 
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> 1- ^/ (1 - 5 x )(l - 5 ph ) - ^bx~5~^ 



(14) 



and the estimated worst possible error rate is: 



£ p h = 




(1 - -)(1 - 25 x ) 

q 



(15) 



We see that errors in the source are more critical when 
the transmission is low. This is due to Eves control of 
the channel, which let her pass to Bob only the systems 
where her operation has given her the most information 
for the least disturbance. If the source is perfect, A = 0, 
loss in the channel does not affect the secret key rate. 
The upper limit on the source error for which key gain 
~ 0.146. This is independent of 



is possible is — < 
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the detector parameter r/z, as long as it is nonzero, but 
demands error rates equal to zero. For larger error rates 
the limit depends heavily on rjz, Fig. [3] 

Channel loss and imperfect sources only contributes 
to an increase in (5 p h- A better estimate of <5 p h would 
increase the rate. This is related to the method of de- 
coy states [22H24] . where Alice instead of producing pz, 
sometimes produces a decoy state with a different mean 
photon number. From the transmission and error rates 
for this state, Alice and Bob are able to derive a stricter 
bound on <5 p h effectively reducing i?z's dependence of 
channel loss. To generalize this method, using decoy 
states where other properties of the signal state are var- 
ied, might prove useful when operating with an imper- 
fect source. However creating such states may require 
the detailed output statistics of the source, and might be 
experimentally difficult in general. 




0.16 



FIG. 3: Plots showing the security bounds Rz = for dif- 
ferent values of nz, 5, and — . The security bound is found 



by setting Rz = in (13 1. Positive key gain is possible for 



parameter values to the left of the curves. We have assumed 
ez = 0, 5 X = S z = 5 and q x = q p h = qz = q- 
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Considering the special case of a perfect source, our 
rate is larger than the rate proved for restricted detector 
flaws in previous literature [SJ [7] . Key gain is possible 
for j]z < 1-^(8 x) ' Unlike previous results, our rate ap- 
plies to all relevant, individual imperfections at the de- 
tectors; for example, mode coupling including misalign- 
ments and multiple reflections, nonlinearities, mode de- 
pendent losses and detector efficiency mismatch, and any 
basis dependence of those effects. Moreover it applies to 
threshold detectors with dark counts. 

Note that the detector blinding parameter r\z is not 
supposed to contain the transmission efficiency of the 
channel. Generally one should factorize £z = £z ° £ 
and £x = £x o £ to put as much as possible of the im- 
perfections into the basis-independent operation £. By 
absorbing £ into Eve and treating £ z and £x as the new 
imperfections, r\z will be maximal. For example, for the 
case where reduced detector efficiencies can be described 
as beamsplitters in front of ideal detectors, and if there 
is no coupling between modes associated with different 
logical bits, r\z 1S t ne minimum ratio between the two 
detection efficiencies {7J. For detectors that cannot be 
modeled by beamsplitters in front of ideal detectors, our 
security proof clearly shows the danger associated with 
the possibility of detector blinding [T3] : If the detection 
probability of a nonvacuum state is zero, our proof pre- 
dicts zero key rate. For the case where the detectors can 



only be partially blinded, our proof can predict positive 
rate. 

Returning to the general case, the rate is dependent on 
A, iqz, and ez, in addition to estimated parameters. For 
a specific QKD setup, A and ez must be upper bounded, 
and j]z and must be lower bounded. How to deal with 
this in practice, is an interesting question for future re- 
search. 



VI. CONCLUSION 

We have proved security for arbitrary, individual im- 
perfections in a BB84 system. The detector model in- 
cludes a basis dependent quantum operation, possibly 
with quantum leakage back to Eve, followed by a three- 
outcome measurement with outcomes "0" , "1" , and "vac- 
uum". Such a general detector model can describe de- 
tector efficiency mismatch, nonlinear blindable behavior, 
response to multiple modes, mode coupling and multiple 
reflections, misalignments, back-reflection leakage, non- 
optical leakage, etc. By reversal of the receipt acknowl- 
edgment measurement on Bob's side (Eve's vacuum mea- 
surement), we show how to treat the general case with 
a lossy channel and general, individual imperfections at 
the source, combined with the flawed detector. 
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